PT-2007-2717 · Li · Li-Guestbook

Published 2007-03-07 · Updated 2024-02-14 · CVE-2007-1302

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LI-Guestbook versions 1.1 through 1.2

Description The issue allows remote attackers to execute arbitrary SQL commands via the country parameter in the guestbook.php file when magic quotes gpc is disabled.

Recommendations For versions 1.1 and 1.2, consider disabling the guestbook.php file or restricting access to it until a patch is available. Avoid using the country parameter in the affected guestbook.php file until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2007-1302

Affected Products

Li-Guestbook

References · 9

• http://belsec.com/advisories/139/summary.html · Vendor Advisory
• http://secunia.com/advisories/27650 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1302 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38369 · Note
• http://securityfocus.com/archive/1/461912/100/0/threaded · Note
• http://securityfocus.com/archive/1/483524/100/0/threaded · Note
• http://securityreason.com/securityalert/2348 · Note
• http://securityfocus.com/bid/22821 · Note
• http://security-news.ws/li-sql-injection · Note